Fallos del tipo CWE-843

606 resultados

Confusão de Tipos

Ocorre quando o código trata um objeto como se fosse de um tipo diferente do seu tipo real, contornando verificações de tipo ou explorando conversões implícitas. Isso permite ao atacante executar operações não autorizadas, acessar memória indevida ou ganhar controle de execução.

Ejemplo

Um navegador interpreta um objeto JavaScript como um array e acessa propriedades além dos limites esperados; ou um objeto C é reinterpretado como um tipo com layout de memória diferente, lendo dados sensíveis adjacentes ou escrevendo em endereços não autorizados.

Cómo mitigar

Validar rigorosamente tipos antes de operações críticas (type checking explícito em runtime), evitar casts inseguros, usar linguagens com type safety forte, e aplicar análise estática para detectar conversões perigosas. Em C/C++, preferir safe casts e checked access patterns.

CVE-2012-0507CRITICALUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier,EPSS 98.1%KEVCVE-2017-8291HIGHArtifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile EPSS 96.1%KEVCVE-2011-0611HIGHAdobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.EPSS 94.2%KEVCVE-2019-0752HIGHA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripEPSS 81.6%KEVCVE-2017-0037HIGHMicrosoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakEPSS 80.4%KEVCVE-2016-7201HIGHThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memEPSS 79.7%KEVCVE-2020-6418HIGHType confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 78.8%KEVCVE-2018-8298HIGHA remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting EnginEPSS 75.3%KEVCVE-2024-6119HIGHPossible denial of service in X.509 name checksEPSS 66.6%CVE-2021-30551HIGHType confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted EPSS 64.7%KEVCVE-2023-34967MEDIUMSamba: type confusion in mdssvc rpc service for spotlightEPSS 60.9%CVE-2023-0286HIGHX.400 address type confusion in X.509 GeneralNameEPSS 59.5%CVE-2021-21224HIGHType confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftEPSS 56.2%KEVCVE-2023-3420HIGHType Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 56.2%CVE-2020-16009HIGHInappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption EPSS 48.6%KEVCVE-2019-17026HIGHIncorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted atEPSS 43.7%KEVCVE-2023-6702HIGHType confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 43.5%CVE-2024-38178HIGHScripting Engine Memory Corruption VulnerabilityEPSS 41.4%KEVCVE-2023-2033HIGHType confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a craftedEPSS 40.8%KEVCVE-2023-4762HIGHType Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (EPSS 38.0%KEV